| The protection of information is essential to the success of any organization. In spite of the growing prevalence of information theft, organizations continue to be ill-prepared to deal with the possibility of both physical and electronic assaults on their information systems. One way that organizations attempt to become proficient in information assurance is by employing personnel who are certified in Information Technology. This research challenges the tacit assumption that certification is sufficient to ensure a higher level of organizational information assurance.;This dissertation compares organizations that employ personnel certified in Information Technology against organizations that do not employ such certified personnel. Because overall information security is bound by its weakest component, it is not necessary to compare all aspects of organizational information security to achieve a valid comparison. This research establishes a reference model that identifies essential practices for the confidentiality of information in storage, and then compares organizations against that reference model. Results generated from more than 130 organizations indicate that, while organizations with certified personnel are slightly more likely to perform essential information security practices, neither group of organizations is performing very well. In one key area, those organizations with certified personnel actually leave themselves more vulnerable to electronic attack than other organizations, as nearly half of the organizations with certified personnel acknowledge having external network connections that circumvent organizational firewalls.;More stunning than the poor performance of many organizations are the indications that organizations holding critical consumer credit information do not even acknowledge a direct responsibility to safeguard that information. This leads to the conclusion that information assurance is more dependent on information security awareness than on technological advances. Another important conclusion is that organizations desiring certified personnel must be willing to pay for the cost of the certification. Over 80% of all personnel certifications represented in this research were fully funded by the organization. |
